How to set up wireshark with correct permissions

Question

Ubuntu 13.10, Saucy Salamander here. I am trying to install wireshark in order to monitor USB activity with a certain device. The problem is that wireshark does not have access to the USB bus (or any bus, for that matter, no interfaces show up).

Here they describe, that wireshark can be run either as root, or as an ordinary user. I tired executing dpkg-reconfigure wireshark-common but after the dialog, nothig happens, and I don't know why.

Here an alternative procedure for other Linux users (non-Debian) is outlined. I haven't tried it, as the dpkg method is the recommended one for Ubuntu and I would like to know what is going wrong.

Where should I look?

Solution 1

I have also run into this in the past (cant speak for SS specifically) This helped me out.

http://ask.wireshark.org/questions/7523/ubuntu-machine-no-interfaces-listed

Basically, this is what needs to be done.

$ sudo apt-get install wireshark
$ sudo dpkg-reconfigure wireshark-common 
$ sudo usermod -a -G wireshark $USER
$ sudo reboot

If there are problems, the linked answer provides more information and techniques.

Solution 2

Those are really both the same method, just in Debian's case you can toggle it easily with dpkg-reconfigure.

After you select Yes to the question "Should non-superusers be able to capture packets?", you still have to manually allow individual users by adding them to the wireshark group:

(sudo) usermod -a -G wireshark [username]

Note that being added to a group isn't effective for your current login, but only subsequent ones (su yourself counts).

Comments

[jrh]

Debian / Ubutnu Users: Note that the dialog box that shows on setup may be referring to a document that doesn't exist in /usr/share/docs yet (it didn't for me when I was installing the Wireshark package through apt), if you're getting here by googling the message for more information, you can read the document it's referring to here

[Vorac]

I had missed this. However, the situation is still not fixed: no interfaces ara available unless root. sw3@pc90313-sw3:~$ groups sw3 sw3 : sw3 adm cdrom sudo dip plugdev lpadmin sambashare usbuser wireshark

[Vorac]

Thanks, I was missing the last step. I took the liberty of plagiatizing some of the content into your answer, in order to make it free-standing and immortal. Thanks a lot!

[Vorac]

So this was one thing, the other was log out and in again. +1

[Vorac]

It actually works prfectly.

[slm]

I already wrote this up on this Q&A: Can't get Wireshark to run as user on CentOS

[goldilocks]

Correct, forgot about the log in/out thing!

[goldilocks]

You don't need to reboot, but the added group membership won't be available for your current login. If you log out and in again it will work.

[Vorac]

Unfortunately, now that wireshark works, it still does not see the USB bus (unless root). IMO there are more premissions to be set somewhere.